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Abstract 

This paper follows very closely a famous paper by Csiszar and Korner about classical 
(non-quantum) wiretap coding. Our paper gives a self-contained and slightly novel 
review of some important results of the paper by Csiszar and Korner. Then we present 
a generalization of those results to the quantum realm, thus giving one of the first 
half-decent treatments of quantum wiretap coding. Like Csiszar and Korner, we too 
find a capacity region (i.e., the maximal achievable region of rates) characterized in 
terms of one-letter informations. We try to make our treatment of quantum wiretap 
coding as parallel a possible to our treatment of classical wiretap coding. This parallel 
treatment is facilitated by the use of CB nets (classical Bayesian networks) for the 
classical case and QB nets (quantum Bayesian networks) for the quantum one. 
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1 Introduction 



For a good textbook on classical (non-quantum) Shannon Information Theory (SIT), 
see, for example, Ref.[T] by Cover and Thomas. For a good textbook on quantum 
SIT, see, for example, Ref. [2] by Wilde. Wiretap coding is an example of network 
information theory, which in turn is part of SIT. For a good textbook on classical 
network information theory, see, for example, Ref. [3] by El Gamal and Kim. 

Wiretap coding is a famous topic in classical SIT. In classical discussions of 
wiretap coding, one considers a situation wherein Alice sends a private message to 
Bob and a shared message to both Bob and Eve. Many workers have pointed out 
that an analogous situation arises when doing quantum communication. In that case, 
the environment plays the role of Eve. 

The subject of classical wiretap coding has an illustrious history. In Ref.[l], 
Wyner found the so called capacity region (i.e., the maximal achievable region of 
rates) for a special type of channel, a "degraded wiretap channel". Wyner character- 
ized his capacity region using one- letter informations. In Ref. [5], Csiszar and Korner 
generalized the results of Wyner to encompass any type of discrete memoryless wire- 
tap channel. They removed the degraded channel assumption, but still characterized 
the capacity region in terms of one-letter informations. 

This paper follows Ref. j5] by Csiszar and Korner very closely. Our paper gives 
a self-contained and slightly novel review of some important results of Ref. [5] . Then 
it presents a generalization of those results to the quantum realm, thus giving one of 
the first half-decent treatments of quantum wiretap coding. Like Csiszar and Korner, 
we too find a capacity region characterized in terms of one-letter informations. 

We try to make our treatment of quantum wiretap coding as parallel a possible 
to our treatment of classical wiretap coding. This parallel treatment is facilitated by 
the use of CB nets (classical Bayesian networks) for the classical case and QB nets 
(quantum Bayesian networks) for the quantum one. 

The capacity regions found by Wyner, then Csiszar/Korner, and now us, are 
3 dimensional. They are a closed, convex set of points (Re,Rs,Rt)- Here Rs is the 
rate of the secret, private message, Rt is the rate of the tapped, shared message, and 
Re is the so called equivocation rate which measures how ignorant Eve is about the 
secret message s. 

Many authors have previously discussed the topic of sending classical and 
quantum messages through a quantum channel, in some cases with "entanglement 
assistance" . See Ref. [2 J for a masterful review with ample references. However, few 
authors have specifically discussed quantum wiretap coding. No previous paper, as 
far as I know, gives a treatment of quantum wiretap coding that includes proofs of 
achievability and optimization for a rate region characterized by one-letter informa- 
tions. 

This paper is written assuming that the reader has first read 3 previous papers 
by the same author. 
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• Ref. [6] is an introduction to quantum Bayesian networks for mixed states. 

• Ref. [7] redoes the classics (the basic theorems of classical SIT) using p-type 
integration techniques and CB nets. 

• Refs. [S] discusses well-known inequalities of classical and quantum SIT from a 
Bayesian networks perspective. 

2 Preliminaries and Notation 

Reading Refs. [6], [7] and [8] is a prerequisite to reading this paper. This section will 
introduce only notation which hasn't been defined already in those 3 papers. 

We will use the symbol (y -H- z) after an equation to indicate that the same 
equation is also valid with y and z swapped. 

Suppose n is any positive integer. Let ) be the random 

variable that takes on values x n = (x%, x 2 , . . . , x n ) G . For any integer j such that 

1 <^ J <C Tl, let %<j — (x'j . X2, • • • , and %>j — yXj^y. X2 ; • • • 5 • 

Given {P(x)}\/ X G pd(Sx), we used in previous papers the expected value 
operator: 



Given a probability amplitude A(x) such that Yl x \ A{x)\ 2 = 1, we will now use the 
following 2 operators which are sort of "square roots" of E x : 



For both CB nets and QB nets, define a source (or root) node as a node 
that has only outgoing arrows, no incoming ones. Define a sink (or leaf) node 
as one that has only incoming arrows, no outgoing ones. Sometimes, to simplify a 
graph, rather than drawing a root node r and its outgoing arrows explicitly, we will 
just put the line r — > x l7 x 2 , . . . , x n beneath the graph, where x l7 x 2 , . . . , x n are 
the children nodes of r . Likewise, sometimes, rather than drawing a leaf node I and 
its incoming arrows explicitly, we will just put the line I <— x 1: x 2 , ■ ■ ■ , x n beneath 
the graph, where x 1? x 2 , ■ ■ ■ , x n are the parent nodes of I . 

For QB nets, a reservoir is defined as a sink or source node that is traced 
over. A reservoir that is a sink can always be traded for one that is a source or vice 
versa. Indeed, if 




(1) 



X 




X 



X 




r 



*E x A(x\r)\x) 
A{r) 




(3) 
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and we define amplitudes A(r|x) and A(x) so that 

A(x\r)A(r) = A(r\x)A(x) 



for all r, x, then we can also write 



(4) 



E 



T.,A(x)\x) 
A{r\x) 



[ h.c. ] 



tr, 



-0 



[ h.c. ] 



(5) 



Ecj-©, call it the "reservoir as past history" version, is more directly related 
to the eigenvalue decomposition of the density matrix p x . Indeed, suppose p x has 
eigenvalues A^ and eigenvectors | A x ) for all x G S x . Then one can set S L = S x , 
y4(x|r) = (x\X r ) and A(r) = \f\.. This makes A(a:|r) an isometry. 

Note that reservoirs can be merged. For example, 



E 



ri,r 2 



A(ri|o,c)A(6|o)|6) 
A{r 2 \c)A{c\b)\c) 



where r = {ri,T2). In diagrammatic language, 



A(6|o)|6) 
A(r|a,c)A(c|6)|c) 



[h.c], (6) 



tr, 




[ h.c. ] = tr. 




[ h.c. ] 



(7) 

This example involved merging 2 sink reservoirs. Two source reservoirs can likewise 
be merged. 

We will often denote the eigenvalues and eigenvectors of a matrix {M x ^}\/ x ^ eSx 
by X X (M) and \X X (M)) for all x G S x . Note that if p x G dm(l-L x ), then {X x (p x )}\/ X G 
pd(S x ). Also if p 2i y G dm(H Xt y), then {A^p^j, )} V:C)2/ G pd(S Xt y). Let A^^ = 
^x,y,e{Px,y ,e ) for some fixed density matrix Px,y,e- Since A Xj?/ie behaves like a classical 
probability distribution, it is convenient to define X x , y = J2 e ^, y ,e, X y \ x = X y:x = 

etc - 

Ax Ay 

Consider a density matrix px, y - Just like we refer to p y = tr 

x P x y 9j 

marginal (or partial, or reduced) density matrix of p x , y , we will refer to X y (p X;y ) = 
J2 X ^x,y{px, y ) as a marginal (or partial) eigenvalue of p X)V . It is important to realize 
that 



\\Px,y) 7^ \{Py) ■ 
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That is, in general, a marginal eigenvalue of px, y is not equal to the eigenvalue of a 
marginal density matrix of p x ,y The provenance of the eigenvalue matters. As with 
famous paintings, one can't trace away part of that provenance with impunity. For a 
diagonal density matrix p^ y (i.e., the classical case), Eq.flS]) becomes an equality. 

3 Conditioning on Two Parents 

The following inequality will prove useful later on. 

Claim 1 If Pa,x,y e dm(Ha,x,y), then 

< S(a\x) + S(a\y) . (9) 

proof: Suppose Pa,x,y,r £ dmiji a,x,y ,r) is a pure state with partial trace Pa,x,y 
Because of CMI > 0, we must have 

S(a\x, r) < S(a\x) . (10) 

Hence 

S( a, x, r) — S( x, r) < S( a \ x) . (11) 
But since Pa,x, y ,r is pure, Eq.flTTJ implies that 

S(y)-S(y,a)<S(a\x) . (12) 

Thus 

- S(a\y) < S(a\x) . (13) 

QED 

I like to interpret inequality Eq.()9]) as saying that conditioning on two parents 
yields a net positive entropy. 

4 Chain Rule Extravaganza 

The theories for classical and quantum wiretap coding both rely on some identities 
that are direct consequences (one might even call then souped-up chain rules) of the 
the chain rules of classical and quantum SIT. This section will derive those souped-up 
chain rules. 

All identities in this section will be stated for classical entropies H , but they 
also hold in the quantum case if we simply replace all H's by S 's. 
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When trying to find the counterpart in quantum SIT of a result in classical 
SIT, it is often helpful to keep in mind that classical and quantum SIT satisfy identical 
(except that if's are swapped by S"s) identities if those identities follow from the chain 
rule. On the other hand, they sometimes satisfy different inequalities. (For instance, 
H( a\b) is non-negative but S(a\b) can be negative.) 

Classically, the chain rule for probabilities can be stated as 

n n 

P(x n ) = TJPixjlx^) = IJPixjlx^) (14) 

3=1 3=1 

for all x n e Sx n , for n random variables x n that are not necessarily i.i.d.. We see 
that there are two versions of this chain rule: one puts conditions on the past and 
the other on the future. 

An alternative notation that I find more symmetrical is as follows. Eschew 
the vertical bar that indicates that conditions will follow. Instead, put a superscript 
of 1 on a random variable that is being conditioned on, and put a superscript of 
on a random variable that is absent (i.e., it's just serving as a placeholder). In this 
"binary" notation, Eq. fH]) becomes 

n n 
3=1 3=1 

Note that in this binary notation, one can go from one version of the chain rule to 
the other simply by swapping and 1 superscripts. 

The chain rule for probabilities immediately implies a chain rule for plain 
entropies and one for conditional entropies. For plain entropies, one gets the following 
chain rule 

n n 
3=1 3=1 

or, expressed in binary notation, 

n n 
3=1 3=1 

For conditional entropies, on gets the following chain rule 



H(x : y n ) = J2H(x : V^V^) = ^H(x : y.\y 

3=1 

or, expressed in binary notation, 



3=1 3=1 
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n n 

H(x : y n ) = J>U : llr Vj, llj) = J2 H ^ : l<f If V.%) 

3=1 3=1 

Claim 2 

H(x : b) -H(x : a) = H(x : b\a) - H(x : a|6) , 
or, equivalently , 

H(x : a°,b) - H(x : a,b°) = H(x : a\b) - H(x : a^b 1 ) . 

proof: 



H(x:a,b) = H(x : b) + H(x : a\b) 
= H(x : 6| a) + H(x : a) . 



QED 

Define 



s <a = : ^\y <f A) = : i<f z ->v a 1 ) , 

and 



3=1 3=1 



Claim 3 
proof: 



^>x=J2 H ^i : y <1 \z>3i±) = J2 H ^i : i<f £>3i A 1 ) ■ 



s< A = E E Hiy.'-y^^^k,^)- 



-3 —<3 
3=1 k=j+l 



j=i fc=i 

n j'-l 

j=i fc=i 

n fc— 1 



Finally, note that YTj=\ Ylk=j+i = ^2k=i SjLi wnen acting on any function of (j, k). 
QED 

Henceforth, we will use the shorthand 

«; = (?/<,■>*>;)■ (28) 

Claim 4 

H(y n :t_) = J2H(y j :a p t_)-J2H(y j :y <] )-^< t (29) 

j 3 

H(z n :t_) = J2H(z r .a p t_)-J2H(zr-^>3)-^>t ( 30 ) 

proof: Just apply the appropriate chain rule to the the first H on left hand side and 

the first H on the right hand side of both equations. 

QED 



Claim 5 



H{y n : s\t_) = Y,H{y 3 : s\g Lj ,t_) + Y l<t _-Y l< s,t (31) 

3 

H(z n : s\t_) = Y J H{z J : s \ a j, t) + S >£ - £ >fi)£ (32) 



proof: 



H{y_ n :s\t_) = Y^H(y. : y\., zlj, s, t 1 ) (33a) 

#(y . : y^., z >J? s°, t 1 ) 
+ H (i j --U i <j >Z 1 >i>Z>t 1 ) \ (33b) 



-3 -<3' 



= S <£ +J2 H (lj : s|«i>*)-S<-,£ (33c) 
i 

QED 

Claim 6 (Csiszdr & Korner's Extreme Chain Ruling Identity) 
H(y n : s\tJ-H(z n : s\tJ = J2H(y j : s\a p t_)-J2H(z r . s\a p t_) (34) 
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proof: Follows immediately from Claims |3] and |5] 
QED 

Define 



Claim 7 

H(s\z- 



nd y = H(s, t\y'' 
ty = H(t_\y n ~), 



n8- 
nS tz 



H(t\z' 



(35) 



H(y n : s\t_)-H(z n : s\t_)-H{t\z n ,s)+n(5 tz + 5 y -5 ty ) (36) 



proof: 



H(s\t) = H{y n : s 1 1 ) + n(S y - 5 ty) 



H(t) = H{y n : t)+n5-, 



ty 



H(t) = H(z n : t) +nS., 



tz 



(37) 
(38) 
(39) 



H{s\z n ) 
= H(s)-H(s : z n ) 

H(s : t, z n0 , y n0 ) 
-H(s : t°, z n , y n0 ) 

H(s : t , z nl , y"°) 
-H(s : t\ z n , y n0 ) 



H(s) + 



H(s) + 



H(s : t) 

H(s : t, f) 
-H{s : y n \t) 



(40a) 
(40b) 

(40c) 



H(s) + H(s : £|2 n ) : z n \t) - H(s : t, y n ) + H(s : y n |tj40d) 

-ff(s : ^ n U) - 



-H(t \z n ,s) 



-n8„ 
+n8, 



ty 



H(s : y n \t) (40e) 



#UU) = H{s : y n \t)+H{s\y n ,t 
= H(s : y n U)+ri(5 y -<y 



(41a) 
(41b) 



H{t_) 



H(t_ : y_ 
H(t_ : r 



+ USfy 



(42a) 
(42b) 



QED 
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Claim 8 



H(s\z n ) = ^2H(y. : s\a^ t_)- S ^ j H(z j : s\a^ t)-H{t_\z n , s)+n(6 tz +5 y -5 ty ) 

j j 

(43) 

H(s\t) = J2 H (y 3 - s\a p t) + J: <t _-J: < s,t+n(5 y -5 ty ) (44) 
j 

j 

H(t_) = Y,H{z j : a,,t) 

3 

proof: Combine Claims El to [7J 
QED 

5 Revisiting Classical Channel Coding 

We will assume that the reader of this paper has first read Ref . [7] . Ref . [7] provides a 
derivation of the capacity for classical channel coding, a derivation based on p-type 
integration techniques. The same p-type integration techniques will be used in this 
paper to derive capacities for classical and quantum wiretap coding. 

In this section, we will mention just a few highlights of the theory of classical 
channel coding as given in Ref.jTJ. We will state those highlights in a form that 
is slightly more general than the form presented in Ref.jTJ. The more general form 
clarifies the connections between channel coding and wiretap coding. 

Channel coding is based on the following CB net: 

(47) 

The probability distribution P y \x, called the channel, is given and fixed. De- 
fin^ 

V gen = {Px,y £ pd(Sx,y) ■ Py\x Axed } . (48) 

For any P e pd(Sx, y ), we can define a convex hull of R's by 
1 gen= "general" 



Y,H{y.:y_ <o )-V <t _+n5 ty (45) 

3 

J2 H< <^ : *>j)-Z<t+ri5 tz (46) 
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TZ(P) = {R m : Rrn < H P (y : x)} . (49) 
It's also useful to consider, for any V C pd(Sx, y ), the set 

U{V) = |J K{P) . (50) 
Per 

The following Lemma will be used later on. 

Claim 9 Suppose a(j) and b(j) are two random variables that are functions of a 
random variable j . Furthermore, suppose b(j) = ((3,j) for some random variable 
0. TheM ~ " 

H(a(j_) : b(j_)\j_) < H(a(j_) : b(jj) . (51) 

proof: 

H(a(l):b(D) i H(a(l):bU),l) (52a) 

> H(a(i): kU)\j). (52b) 

(i) follows by cloning j , which is a component of b(j ). (ii) follows from the chain 

rule. 

QED 

Later on, we will use random variables a - that are labeled by an index j = 
1,2, ... ,n. The index j can be promoted to a random variable that is uniformly 
distributed, j is often called a "time sharing variable". We can then use Ej = - J^V. 
a j can be thought of as a special case of a(j) when j is uniformly distributed. 

Claim 10 Achievability: VB^, if Rm £ ^{Vgen), then 3 an encoding and a decoding 
that satisfy lim^oo P err = for the CB net of Eq. [J^D - 

proof: A proof of this is given in Ref. [7j. We will not repeat that proof here. That 
proof is very similar to the achievability proofs that will be presented later in this 
paper. 
QED 

Claim 11 Optimality: Vi?m , if 3 an encoding and a decoding that satisfy lim n ^ 00 P err = 
for the CB net of Eq.g^ then R m e 1Z(P gen ). 

2 Note that the inequality in Eq.([5Tj) is different from H(a\j) < H(a), which is just MI> 0. 
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proof: 

A proof of this is given in Ref. [7]. We will not repeat that proof here. That 
proof is of the type most commonly found in introductory SIT textbooks. Let us 
present here an alternative proof which is more akin to the optimality proofs which 
will be presented later in this paper. 



nRrn = hiiV™ = H(m) = H(m : y n ) + H(m\y n ) (53a) 

< H(m : y n ) + n5 (53b) 

n 

= ^H(y_.: y_ <j ,m)+n5 (53c) 

3=1 

= nH(y.:y <j ,m\j_)+n6 (53d) 



= n(H(y 

< n{H{y 

< n(H(y : x) + 5) (53g 



u\j_) + 6) (53e) 
u) + 5) (53f) 



( I53bl) This follows from Fano's inequality, which says that if lim^oo P err = 0, then 
H( m\y n ) < n5 with lim^oo 5 = 0. 

(I53cf) This follows from the chain rule for MI. 

( 153dj) This follows from defining a new, uniformly distributed random variable j with 
states j = 1, 2, . . . , n. 

(I53ep This follows from a change of notation y — > y and ( y , m , 7 ) — > u. 
fl53fj) This follows from Claim |9j 

(|53gP This follows from the classical data processing inequalities. 



QED 

In the above optimality proof, we start with the CB net of Eq. fj471) . Then we 
do some "chain ruling" reminiscent of peeling away all n layers except one. We end 
up with a different CB net with random variables y , x, u. It's instructive to present 
a chain of CB nets connecting the beginning and ending CB nets of this process. 

One starts with the CB net (C implicit) 




(54a) 



Tracing over (i.e., adding over all states of) the node m (highlighted with a double 
circle) gives 
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(54b) 



The previous CB net equals 




(54c) 



Tracing over all the nodes highlighted with a double circle gives 




(54d) 



Merging the m and y . nodes and promoting the index j to a random variable, we 
get 




(54e) 



In the last graph, we leave implicit a source node j with outgoing arrows pointing 
into all nodes that mention j . 

From Claims ITUl and [TT] we see that 7Z(V gen ) is the maximal achievable region 
(MAR) of -Rm's. Some authors refer to the MAR as the "capacity region". One 
defines the channel capacity C by 



C = max R m = max Hp(y : x) . 



Pev„ 



(55) 



Simply put, for channel coding, the MAR is just a closed interval [0,(7]. The upper 
limit point C of this MAR is called the channel capacity. 



6 Classical Wiretap Coding 

In this section, we derive the channel capacity for classical wiretap coding. Everything 
we prove in this section has already been proven by Csiszar and Korner in Ref. [5]. 
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However, some of our proofs (most notably our achievability proof) differ significantly 
from those presented in Ref. [5]. We find that our alternative proof methods are easier 
to generalize to quantum wiretap coding. 

To help those readers who want to compare our proofs to those of Ref. [5] , we 
try in this paper to use names of variables that are identical or at least very similar 
to those of Ref. [5]. As in Ref. [5], the channel considered in this paper takes x n to 
(y n ,z n ). Like Ref.[5], we use the letter s to denote the "secret" signal, one that is 
visible only to the observer that measures the y n output. And we use the letter t 
to denote the "tapped" or shared signal, one that is visible to both the y n and z n 
observers. 

We consider all wiretap coding protocols that can be described by the following 

CB net 



with 




P(x n \s, t, C) = 6(x n , x n (s, t)) , (58) 

/>(//'.:",■") l[l'( l , r z l .r i ). (59) 

j 

P(s\y n , C), P(t E \y n , C), P(t & \z n , C) = to be specified , (60) 

and 

P{C) = to be specified . (61) 
Assume that we are given a channel {P(y, z\x)}\/ VjZ G pd(S y< z) for all x G Sx- The 

encoding P(C) and decoding P(s\y n ,C), P(t y \y n ,C), P(tz\z n ,C) probability distri- 
butions are yet to be specified. 
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We will consider 3 different coding rates: 



R, 



H(s k \z n ) 



lniV, 



Ri 



In N t . 



(62) 



nk n ~ n 

By definition, all 3 R's are non-negative. To define Re, called the equivocation rate, 
we've replaced s by a block of k letters s k . CMI> implies that -^H(s k \ z n ) < 
Yl!j=i z. n )- W we assume H{ Sj\ z n ) is the same for all j = 1, 2, ... k, then 

^H(s k \z n ) < ^His^z* 1 ). Furthermore, MI> implies that ^H(s 1 \z n ) < \H{s x ) 
R s . We can now set s 1 to s. We have established that 



< R P < -H(s\z n ) < R. 



n 



(63) 



Note that Re = Rs implies H(s) = H(s\z n ) or, equivalently, H(s : z n ) = 
0. Thus the case R^ = Rs can be described as perfect secrecy. The case Rt = can 
be described as zero tapping rate. 

Let 



R=(Re,Rs,Rt) ■ (64) 

We will always assume in this paper that s and t are independent. (Ref.[5] 
sometimes assumes they aren't). Ref.[5] defines Rg 
independent, H(s\t) = H(s) = lniV^. 

For a given, fixed channel P y ,z\x, define 



H{s\t) 



When s and t are 



V, 



gen 



Ry,z,v,u ^ pd(S y,z,v,u) '■ p fixed 



P(y,z,v,u) = J2 X p (Vi z\x)P(x\v)P{v\u)P{u) 



y,£\a± 



(65) 



In terms of CB nets, the elements of V gen must have the following graph topology 




(66) 



We will say that P(y, z\v, u) factors in y and z if P(y, z\v, u) = P(y\v, u)P(z\v, u) for 
all y,z,v,u. (i.e., conditional independence). It is convenient to define the following 
subset of Vg e n 



Vfac = {P e Vgen ■ Py,z\v,u factors in y and z] 



(67) 
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The elements of Vf ac have the same graph as Eq. (l66"I) except without the arrow 
connecting z and y . 

For any P G pd(S yt z,v,u), we can define a convex hull of -R's by 



K(P) 



R = {Re , Rs, Rt) g 



< Re < Rs,0 < Rs,0 < R t _, 
Re < H(y '■ V. I U.) ~ H(z : v | u] 
?3 R,+Rt<H(y:v\u)+£, 
R t <i, 

£ = min{H(y : u),H(z : u)} 
all H evaluated at P 



> . (66 



It's also useful to consider, for any V C pd(S y ,z,v,u), the set 

K(V) = |J K(P) . 



(69) 




Figure 1: Rt =0 crossections of the sets 1Z(V gen ) and 7?.(P) for some particular 
point P G V gen . 7l(P) is a convex hull, which is a set bounded by straight lines (or 
by planes in higher dimensions). TZ(V gen ) doesn't necessarily have completely straight 
sides but it must still be convex. 



TZ(V) for arbitrary V is not always a convex set. For instance, it isn't if V 
consisting of just two P's. But how about TZ(V) when V = V gen f 

Claim 12 lZ{V gen ) is a closed convex set. 

proof: 7Z(V gen ) is a union of closed sets so it is closed. Next we prove convexity. 
Suppose b is a random variable with Sb = {0, 1}. Let Eb = Ylb^i^ 1 )- 
In this proof, we will use the shorthand 

£(b) = (y(b),z(b),v(b),u(b)) . (70) 
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for b = 0, 1. Furthermore, we will use £ _.(b) with j G {1,2,3,4} to denote the four 
components of this vector. £ (0) and £ (1) represent two different CB nets. Note that 
in general ( ) 7^ (1) for all j. 

We want to prove that if R(b) G 1Z{V gen ) for b = 0, 1, then £ b .R(&) G 1Z{V gen ). 
This means that if we are given 2 CB nets £ (0) and £ (1) such that P^a>) G "P 9era and 

-R(fe) G Tl{P^ (b)) for 6 = 0, 1, the we can find an average CB net £ such that P^ G P 9en 

and E b R(b) G ft(P|). Define P = E b R(b). We want to prove that P G P(P^). 

We define the average CB net £ to have the topology prescribed by V gen , with 

nodes 

i, = [£,(0), i/i), b] (71) 

for all j. If we assume that 

P(l=t\k=b) = P(£(b)=t(b)), (72) 

then 

P(i=0 = E P (i =t\k=b)P(b) (73a) 

= E p (i( & ) = ^)) p ( & ) ( 73b ) 

b 

= E b PU(b)=m)- (73c) 



One has 
for b = 0, 1. Hence 

Hence 

Next note that 



0<Re(b)<Rs(b) (74) 



< E b Re(b) < E b Rs(b) . (75) 



< Pe < Ps • (76) 



#p £ (|/ : u I «) - #p £ U : u I «) = 

= H Pi (y:v\u,b)-H Pi (y:v\u,b) (77a) 

= P 6 {^P s(b )(y(fe) : v(b)\u(b))-H Pi{b) (y(b) : t, (6)| « (6)) } (77b) 

> E b R e _(b) (77c) 

= Pe • (77d) 



17 



Next note that 



Likewise, 



Hp i (y : v\u) + H Pi (y_ : u) = 

= Hp i (y--v\u,b) + H Pg (y:u,b) (78a) 

> H P( _(y:v\u,b) + H Pg (y:u\b) (78b) 

= E b {H Pi{b) (y(b) : v(b)\u(b))+H P(Jb) (y(b) : «(&))} (78c) 

> E b {Rs(b) + R t _(b)} (78d) 
= Rs+Rt- (78e) 



#p,(y : u|«) + #p £ U : u) >P* + Pt ■ (79) 



Next note that 



Likewise, 



Pfpjy : m) = Fp s (y : u,b) (80a) 

> #P s (y : «|6) (80b) 
= E b Hp i(b) (y(b) :«(&)) (80c) 

> P 6 P*0) (80d) 
= R t . (80e) 



H P Az:u)>R t _. (81) 



QED 
Claim 13 



^(Pgen) = ^(P/ac) • (82) 



proof: Vf ac C P 9en so lZ(Vf ac ) C TZ(V gen ). Next let's prove the reverse inclusion. 
Suppose P y ,z,v,u £ P 9 en- Py,z\v,u only appears in the definition of P(P) through its 
marginals P y \v,u and P z\v,u- The set P(P) doesn't change if in its definition, one 
replaces everywhere the probability distribution P y ,z \v,u {y, z\v, u) by the product 
probability distribution Py\v,u(y\ v J u )Pz\v,u{z\v,u). Both probability distributions 
belong to pd(S y> z) for all v,u. Given P e P se „, we have found P G P/ ac such that 

P(P) = K{P). 
QED 
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6.1 Optimality 

Claim 14 Optimality: WR, if 3 an encoding and a decoding that satisfy lim n ^oo P err = 
for the CB net of Eq.^Ej, then R E n(V gen )- 

proof: The proof starts from the result Claim |HJ As pointed out in the section that 
ends and culminates with Claim [HI Claim |8j is basically a souped-up version of the 
chain rule. To prove the current claim, we will need to add 3 new ingredients that 
are not consequences of only the chain rule. First, we will use Fano's inequality (see 
Ref.pQ). Second, we will use the fact that classical clone random variables can be 
merged. By this we mean that 

H(a : b, c|c) = H(a : b\c) (83) 

for any random variables a, b, c. Third, we will use Claim [9j 

Note that, by assumption, lim^oo P err = 0. Hence, by Fano's inequality, the 
S y , Sty and St z used in Claim[8jgo to zero as n — > oo. Furthermore, classical conditional 
entropies are non-negative and CMI>0 so 

0<-H(t\z n ,s)<-H(t\z n ). (84) 
n n 

But Fano's inequality implies that lim^oo -H(t\z n ) = so also 

lim -H(t\z n , s) = . (85) 

n— >-oo n 

Let j be a random variable that is uniformly distributed and has states j = 
1, 2, • • • , n. Let E~ = - Y]-. Define 

u = {y <j , z >L , t,j_), 

v=(u,i), . (86) 

x = xj, y = y j , z = Zj 

After dropping t\z n , s) and the deltas 5 y , S ty , S tz , the 4 identities (souped- 
up chain rules) of Claim |8j yield the following 4 inequalities. 

• Eq.gaD yields 



R e < -H(s\z n ) (87a) 
n 

= EjH(y . : s|a,-, t) -EjH(z, : s|a,-, t) (87b) 

— j J J J 

= H(y.:s\a l ,t,i)-H(z_ l :s\a i ,t,i) (87c) 

= H(y : v\u) - H(z : v\u) . (87d) 
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Eq.flSD yields 



R s = EjHiy : s\a p t) + 

—J n n 

= H(y : s\a J} t_ }3 ) + ^-^± (88b) 

— 2 - - n n 

= H(y : v\u) + ^~^± (88c) 

— n n 

< #(y : + — • (88d) 

— 7i 



Eq.flU yields 



= t)-EiH{y. : y^.) - ^ (89a) 



E 



#(?/, = Slf, £|j) = (89b) 



n 



^(2/ = u\j)-H{y . : y U)-^ (89c) 

— - — Z — <2 - n 

< : u|j)-^i (89d) 

— - n 

< H(y : «) - -^i . (89e) 



Eq. fl89eD follows from Claim EJ 
Eq.gSP yields 



fit = : a jt t) - E j H(z j : z yj ) - (90a) 

= : a;,£|j)-#U; : ^>,|j)-^ i (90b) 

= #U = l*U)-#Uj = ^>,|j)-^ i (90c) 

< #U : u\ j) ~ — (90d) 

- n 
v 

< #U : «) 11 • (90e) 

n 



Eqs. (I89el) and (I90e[) can be combined by writing 



Rt^i-^ 1 - (91) 
n 
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— * 

From all we've said so far, it's clear that R G 7Z(V gen ). 

QED 

In the above optimality proof, we start with the CB net of Eg. (1561) . Then 
we do some "chain ruling" reminiscent of peeling away all n layers except one. We 
end up with a different CB net with random variables y , z, x, v_, u. It's instructive 
to present a chain of CB nets connecting the beginning and ending CB nets of this 
process. 

One starts with the CB net (C implicit) 




(92a) 



Tracing over all the nodes highlighted with a double circle gives 




(92b) 



The previous CB net equals 
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The previous CB net can be "accommodated" or modeled by the following CB net. 




In the last graph, we leave implicit a source node j with outgoing arrows pointing 
into all nodes that mention j . 

6.2 Achievability 

This section will give a proof of achievability for classical wiretap coding. The proof 
is very similar to the one given in Ref.^ of achievability for classical channel coding. 

Claim 15 Achievability: Vi? ; if R G TZ(V gen ), then 3 an encoding and a decoding 
that satisfy lim^oo P err = for the CB net of Eq. /[5b]) . 

proof: 

Suppose P G V g en and R G 7£(P). 

We consider all wiretap coding protocols that can be described by the following 

CB net 




We will use a codebook C = {C^ ,Cy,Cu) composed of 3 sub-codebooks. Code- 
book Cx is as an NsNt x n matrix given by = {x n (s, £)}vs,* = x n (-) where 
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x n (s,t) G SI for all (s,t) G S* x 5*. Similarly, = {w n (s, t)} Vs , t = f n (-) where 
G SI for all (s,t) and C„ = {«"(*) }vt = «"(•) where u n (t) G for all t. 

We will use the shorthand notations M = (s", t y ,tz) and m = (s, £). Let / be 
the function that maps f(m) = f(s,t) = (s,t,t) for all s,t. 

We assign to the CB net of Eq. (l93|) the following node transition matrices: 

P(s) = 7^7 ■ p « = W t • (94) 

P(u n \t,C) = 5(u n ,u n {t)) , (95) 

P{v n \u n , s, C) = 5{v n , v n {s, £)) , (96) 
where v n (s,t) = v n (s, u n (t)), 

P(x n \v n ,C) =6{x n ,x n {s,t)) , (97) 
where x n (s,t) = x n (v n (s,t)), 

P(y n ,z n \x n ) = l[P(y j ,z j \x j ), (98) 
5 

P(C) = l[P(x n (s,t),v n ( S ,t),u n (t)) = nP^Ms^vfatlujit)) , (99) 

s,t s,t,j 

where P^ tjltU (x,v,u) = Px\v{x\v)Pv\u{v\u)Pu(u), and 

5 

P(M\y n ,z\C) = l[ JJ ^(i? M <r M ), (100) 

where the quantities m^, i? M and are defined in Appendix [A] Assume that we are 
given a channel {P(y, z\x)}y y>z G pd(S Vt z) for all x. 
The probability of success is defined by 

P S uc = P(M=f(in)) . (101) 

One has 

Psuc = Y. 6i ^=f{™))P{M,m) (102a) 

m 



M.m 



N s N t 

- - si C y n ,z" 



£ c ^P(yVVX?,t))n II ^<Tf), (102c) 
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where @t means evaluated at t y =t z = t. 
Let 

" +0 ° dkjm 



. n n (i-co 2./ (Mm,)-^/ ' (l03) 



and 

tf„= fc,K) . (104) 

We will also use the following shorthand notation 

x = x(s, t) , v = v(s,t) , u — u(t) , (105) 

and 

£ = (y,z,x(-),v(-),u(-)). (106) 
Expressing the 9 functions in Eq. (jl02cj) as integrals, we get 

P suc =je-^ K ^ e ^" p n(Oin^) ; (1Q7) 

k J™,2™,X"('),t)"(-),U™(-) 

where 

Z(0 = P(y,z|ir)n{ P(x(s,t),v(s,t),u(t)) }J] J] " W|108a) 

^(M*)IL, t { P(a:(M)KM),u(*)) } 

n s , { PMMMt)) } rc=i {^f^w} ' (108b) 

where the quantities 7 M are defined in Appendix lAl 

Next we express the sum over y n , z n , x n (-),v n (-), u n {-) in Eq. (I107[) as a p-type 
integral and do the p-type integration by the steepest descent method. We get for 
the leading order term: 



a u c 



e -iJ2,K,R, e nlnZ ? 



k 



where 



z = J2 z (0- (no) 

Note that in Eq. flllOp . the sum over the x(-) component of £ can be done easily 
because none of the 7 M depend on x(-) so we may set 
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P{V, z\x) J] {P(x(s, t)\v(s, t), u(t))} = P{y, z\v, u) 

x(-) s,t 

Hence, using the shorthand notations 



and 



E 



w(s,t),it(t) s,t 



Z can be expressed as 



Z = Ey ;Z E V (.) )U (.) 



Define 



— Ey jZ E^ t u 



P{y,z :v,u) Y[{&J } 



where the quantities $ M are defined in Appendix HI 
Define the integration operators 



= n 



2tt 



and 



Note that 1 equals 



n 



lfc>o,jf = v]]^^ > °) • 



{P + CO 
J — OO / — 



Multiplying P suc by 1 certainly doesn't change it. Thus the right hand 
Eqs. (11091) and (1118bl) can be multiplied to get 
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Next we will assume that, for all m u , when doing the contour integration over 
k u (m u ) in Eq. fl!19j) with Z given by Eq. (jll4p . the e nlnZ can be evaluated at the value 
kai^u) = it ~ > of the pole. Symbolically, this means we will assume 

i e *E M ^E mM7 ^ M M«v) e ninZ = e ninz i g'E/cE^^ ^K) (120a) 

= e nlnZ ° JJ{0(^ > 0)} . (120b) 



Applying Eq. (fl20b|) to Eq.(TTT9l gives 

Psuc = l h> o,Ke-^ K ^e nl « Zo . (121) 
Expanding In Z to first order in and doing the h and K integrals yields 

5 

Psuc « Jj0(i2 M <^) (122a) 

= 0(R G ft(P)) , (122b) 

where the quantities are defined in Appendix IA1 
QED 

6.3 Capacity 

From Sections 16.11 and I6.2[ we see that TZ(V gen ) is the maximal achievable region 
(MAR) of i?'s. The MAR is a closed convex set. We define the channel capacity as 
the value of Rg at one of the corners of the MAR. 
Define the line 

£ = {ReR 3 :R t _ =0,Re =Rs}- (123) 
One defines the channel capacity C s by 



Co = max R s = max {Hp{ y : fin) — Hp( z : v I u)\ . (124) 

Some authors put extra restrictions on the wiretap channel P(y,z\x) and use 
Claim [TB] given below. They do this in order to reduce and simplify the MAR and to 
simplify the formula for the channel capacity. It is also possible to trim Vf ac . That 
is, to find V C Vf ac with 1Z(V) = r R-(Vf ac )- One can, for example, place bounds on 
AT;, and by polynomial functions of N%. This reduces the size of the space V 
one must search over in order to calculate the channel capacity. See Ref . [5] for more 
details. 
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Claim 16 For a Markov chain a <— e ^— b (or any tri-node Markov-like chain with 
e in the middle), 

H(a : e\b) = H(a : e) - H(a : 6) . (125) 

proof: Claim [2] implies 

H(a : e\b) = H(a : b\e) + H(a : e) - H(a : b) . (126) 

But for the type of graph that is assumed as a premise, one has H(a : b | e) = 0. 
QED 

7 Quantum Wiretap Coding 

In this section, we consider quantum wiretap coding. We try to make our treatment 
of quantum wiretap coding as parallel a possible to our treatment in the previous 
sections of classical wiretap coding. This parallel treatment is facilitated by the use 
of CB nets for the classical case and QB nets for the quantum one. 

We consider all wiretap coding protocols that can be described by the following 
QB net 



with 




[ h.c. ] (127) 



(128) 



A(x n \s,t,C) =S(x n ,x n (s,t)) , (129) 
A(y n ,z n \x n ) = l[A(y J ,z J \x 3 ), (130) 

3 
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A(s\y n , C), A(t y \y n , C), A(t, \z n , C) = to be specified 



(131) 



and 



A(C) = to be specified . 



(132) 



Assume that we are given the reservoir amplitudes A(r s \s) and A(r± \t). Assume that 
we are also given an isometry A(y, z\x) (called the wiretap channel amplitude for 
this problem). The encoding A(C) and decoding A(s\y n ,C), A(t y \y n ,C), A(tz\z n ,C) 
probability amplitudes are yet to be specified. 

We will consider 3 different coding rates: 



R, 



S(s k \z n ) 



R, 



In AT 



Rt 



In A* 



(133) 



nk n ~ n 

Clearly, R^ and Rt must be non-negative. R & must be non-negative too even though 
it is defined as a quantum conditional entropy and those can sometimes be nega- 
tive. But not this time, at least not for very large n. This is why. — -S( s k \y n ) < 
-S(s k \ z n ) by Claim [TJ Furthermore, lim^oo — -S( s k \y n ) = by Alicki-Fannes's 
inequality, assuming an encoding and decoding that satisfy lim n ^oo P err = 0. Thus, 
Re > 0. To define Rg , called the equivocation rate, we've replaced s by a block of 
k letters s k . CMI> implies that ±S(s k \z n ) < EjU ^UjU")- If we assume 
S(s.j\ z n ) is the same for all j = l,2,...k, then s k \ z n ) < \S{s 1 \z n ). Further- 
more, MI> implies that ■^S(s- i \z n ) < ^(s^ = Rs- We can now set s 1 to s. 
We have established that 



< R. < 



S(s\z J 



< R< 



n 



Let 



(134) 



R — (Re,Rs, Rt 



For a given, fixed channel A 



y ,z\xi 



define 



(135) 



V, 



gen 



Py ,z,v,u 



Py,z,v,u 



A y 3 z | x fixed 



J2y, z , x ,v,u A (y,z\x)\y) 

A(x\v, u) 
A(y\u)\v) 
A(u)\u) 
A(r\y,z,v,u) 



[ h.c. ] 



(136) 



In terms of QB nets, the elements of V gen must have the following graph topology 
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' y ,z,v,u 



tr, 




[ h.c. ] . 



(137) 



r «— y , z, v, u 

Note that, unlike its classical counterpart Eq. fl66|) . this graph has an arrow from u 
to x. 

Define 



A(y,z\v,u) = ^ A(y,z\x)A(x\v, 



u 



(138) 



We will say that A(y,z\v,u) factors in y and z if A(y,z\v,u) = A(y\v,u)A(z\v,u) 
for all y,z,v,u. (i.e., conditional independence). If also A(y\v,u) and A(z\v,u) are 
both isometries, we will say that A(y, z\v,u) iso-factors in y and z. It is convenient 
to define the following subset of V gen 



Vfac = {P e V gen : Ay^\^ % iso-factors in y and z) . (139) 

The elements of Vf ac have the same graph as Eq. (I137j) because, by convention, the 
marginalizer nodes y and z are drawn without an arrow connecting them regardless 
of whether these two nodes depend on each other or not. 

For any p G dm(H y ,z,v,u), we can define a convex hull of .R's by 



K(p) 



R — (Re,Rs, Rt) £ 



< Re < Rs,0 < Rs,0 < R t _, 
Re < S(y : v\u) — S(z : v\u] 

d3 Rs+R t ~<S(y:y\u)+e, 

' ' Rt_<£, 

£ = min{S(y : u),S(z : u)} 
all S evaluated at p 



(140) 



It's also useful to consider, for any V C dm^H y> z,v,u)i the set 

K{V) = |J K{p) . (141) 

Fig{T] was given initially for classical wiretap coding, but it is still valid for 
quantum wiretap coding. 



Claim 17 7Z(V ge n) is a closed convex set. 
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proof: The proof is almost identical to that of Claim | 

The random variable b is still classical, even in the quantum case. 
Here are some small differences between the 2 proofs. Instead of 2 CB nets 
with probability distributions P^fb) G V gen , we consider now 2 QB nets with density 
matrices Pf(6) G V gen - Instead of an average CB net with probability distribution 
P^ = EbP^(b), we consider a QB net with density matrix = E^p^^y Instead of 
HQ's, we use .SQ's. 
QED 



Claim 18 



gen, 



K(V fa 



(142) 



proof: We won't give a rigorous proof of this, just a plausibility argument. 

Vfac C Vgen so lZ(Vf ac ) C 7Z(V gen ). Next let's prove the reverse inclusion. 
Suppose p Vt z,v,u G Vgen- P y ,z,v,u only appears in the definition of TZ(p) through its 
marginals Py,v,u and Pz,v,u- 

For the rest of this proof we will use the shorthand notation £ = (v, u). 

pz, y ,i has the form 



E 



E y , z ,sAy,z\0\y) 

A(r\Vi z >€)\ z ) 



[ h.c. ] . 



(143) 



We would like to find a new density matrix Pz.y,£ in terms of the original density 
matrix Pz,y,£- We would like pz.y.£ to be of the form 



P*,y,t 



E 

R 



A(R\y,z,0\z) 

M0\0 J 



[ h.c. ] 



(144) 



where and are both isometries, and such that p z ,y,£ and Pz,y,t have 

the same marginal density matrices p y ^ and p z ,£- 

We will set A(£) = A(£) for all £. Stated more explicitly, we want pz, y ,i to 
satisfy the constraints: 



E 

R,y 



Ez^Mvmm 



h.c. 

z -> z' 



E 



r,;y 



(which is equivalent to p zt, = Pzt and p y ^ = p y ^ 



Ez^(y,z\0 



h.c. 

Z -> 2' 

£^£' 



E [ ^10 ] 



h.c. 
£^£' 



<$f , (y z) 



, [y^z] 

(145a) 
(145b) 
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and 

^|A(i^,£)| 2 = l. (145c) 

R 

Let's count the number of unknowns (i.e., real- valued degrees of freedom). 

• A(y\^) G C so it contains 2N y N^ unknowns. 

• A(z|£) G C so it contains 2N^N^ unknowns. 

• A(R\y, z, £)) G C so it contains 2NrN v NzN^ unknowns. 
That's a total of 

2NyN i + 2N,N i + 2N R NyNzN i 

unknowns. 

Next, let's count the number of independent equations (i.e., independent real- 
valued constraints). Recall that an N x N Hermitian matrix contains N 2 degrees of 
freedomjf] 

• Eqs. ( 1145a) give (N^N^) 2 + (N y N^) 2 independent equations. 

• Eqs.( 1145bl) give 2N 2 - independent equations. 

• Eqs.f ll45cl) give NyN^N^ independent equations. 

That's a total of 

(iV,iV s ) 2 + (NyN^) 2 + 2N\ + N y _N 1 N i 

independent equations. 

Now note that we can always make N r large enough so that the number of 
unknowns is greater or equal to the number of equations. The moral is that when 
we replace A(y,z\£) by a product of two isometries A(y\£) and A(z\£), we are losing 
degrees of freedom. Those extra degrees of freedom can be transferred to the reservoir 
whenever the only part of p y> z,v,u that is visible are the marginal density matrices 

Py 1V1V. Pz.iV.iVl' 

Given p G V gen , we have found p G Vf ac such that TZ(p) = TZ(p). 

QED 

For quantum wiretap coding, we will prove below an optimality theorem for 
Tl(Vgen) an d an achievability theorem for 1Z(Vf ac ). Since 7Z(V gen ) = 7Z(Vf ac ), this 
will show achievability and optimality over the same set of i?'s. 

Let the Hermitian matrix have entries Hij. If i < j, store the real part of Hi j at position 
and the imaginary part at position (J, i). If i = j, Hi i is real. Store it at position (i, i). 
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7.1 Measuring Success in Quantum Communication 

When considering communication through any channel, whether it be a classical or a 
quantum one, it behooves us to define a measure of the success of that communication. 
In this section, we will review the measures of success in communication that we used 
previously for classical channel coding and classical wiretap coding. Then we will 
explain how we will measure success in communication for quantum wiretap coding. 

In classical channel coding, an N m x N m transition matrix {P(m\m)}\/m,m, 
sends P m G pd(Sm) to F„ G pd(Sm) as follows 

Prn (m) = P{m\m)Prn (m) , (146) 

m 

where 

P(m\m) = ^P(m\y n )P(y n \x n {m)) . (147) 

y n 

P err was defined in Ref.[7] as the sum of the off-diagonal entries of the transition 
matrix divided by Nm- Thus, P err = if and only if P{m\m) = 5™. We found that 
this occurs for small enough values of R m : 

P(m\m) = 5(m,m)6(R m <H(y:x)). (148) 

Note that our definition of P err , as the sum of the off-diagonal entries of P(rh\m) /N m , 
is just one possible definition of a distance between P{m\m) and 6™. We could, for 
example, have chosen instead, as a measure of that distance, the maximum of the off 
diagonal entries of P(fh\m). 

In classical wiretap coding, an N ^ x N m transition matrix {P(M\m)}^ 
sends P m G pd(Sm) to Pj^ Epd{S^) as follows 

P m (M) = P (M\m)Prn (m) , (149) 

rn 

where 

P(M\m) = P(M\y n ,z n )P(y n ,z n \x n (m)) . (150) 

y n ,z n 

Let the non-diagonal entries of the transition matrix be defined as those entries whose 
indices M, m satisfy M ^ m. P err was defined earlier in this paper as the sum of 
the non-diagonal entries of the transition matrix divided by N m . Thus, P err = iff 
P(M\m) = 5(M, f(m)). We found that this occurs for small enough values of R: 

P(M\m) = 5(MJ(m))9(ReK(P)) . (151) 
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Note that our definition of P err is just one possible definition of a distance between 
P(M\m) and 5(MJ(m)). 

In quantum wiretap coding, a channel superoperator T^j^ m sends a density 
matrix p*™ G dm{'H m ,) into a density matrix p°~? G dm{H^) as follows 



In general, the density matrix p™ has matrix elements of the form: 

h.c. 



(m\pZ\m 



') = X) I ^( r ™l m )^( m ) ] 



m — )■ m' 



(152) 



(153) 



for all m,m' G One can also find the matrix elements of the channel superoper- 
ator Tjj| m . They have two indices M, M' G and two indices m,m' G S*™. From 
Eq.( ll52p one gets 

(M\ P °^\M f ) = ^ffiT m ^(\m){m\feW{m'\)\M>) ( 154a ) 
= £)Hp£K> (M|T £| ^(|m)<m'|)|M'} (154b) 



where the matrix elements (M\T^^ m (\m)(m'\) \M') of the channel superoperator 
l m nave the general form 



(^|7"m|™(I™>KI)I^'>= E [MM,y n ,z»\m) 



y ,z 



h.c. 

m — )■ m' 



(155) 



For quantum wiretap coding, rather than give one of many possible definitions of 
P err , we shall prove below that: the matrix elements of the channel superoperator 
equal 8{M, f(m))5(M' , f{m')) for small enough i?'s. That is, we will prove that 



<M|T £n (|ro)<m'|) |M') = *(M, f(m))5(M>, f(m'))9(R G ft(p)) . 



(156) 



Thus, the channel superoperator T^| m can transmit density matrices p 1 ^ faithfully 
for small enough Ws. 



7.2 Optimality 

Claim 19 Optimality: Vi2, if 3 an encoding and a decoding that satisfy lim^oo P e , 
for the QB net of Eq.fiWfy, then R G Tl{V gen ). 
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proof: The proof of optimality for quantum wiretap coding is very similar to the 
proof of optimality for classical wiretap coding. The main difference is that Eq.f lBB"]) 
cannot be used in the quantum case. In the quantum case, random variables cannot 
be cloned unless they are classical. (See Ref. [S] for a discussion of this). Because of 
this, we will end up defining v and u differently for quantum and classical wiretap 
coding. 

The proof starts from the result Claim |HJ As pointed out in the section that 
ends and culminates with Claim [HI Claim |H] is basically a souped-up version of the 
chain rule. To prove the current claim, we will need to add 2 new ingredients that are 
not consequences of only the chain rule. First, we will use Alicki Fannes's inequality 
(see Ref.p]), which is a generalization to the quantum realm of Fano's inequality. 
Second, we will use Claim [9] with HQ — > S(). This claim is still valid in the quantum 
realm as long as j is a classical random variable. 

Note that, by assumption, lim^oo P err = 0. Hence, by Alicki Fannes's in- 
equality, the Sy,S ty and S tz used in Claim [8] go to zero as n — > oo. Furthermore, Claim 
□ and CMI>0 imply that 

- -S(t\y n ) < -S(t \z n , s) < -S(t\z n ) . (157) 
n n n 

But Alicki Fannes's inequality implies that both sides of the last equation, — -S(t \y n ) 
and -S(t | z n ), tend to zero as n — > oo. Hence, also 

lim -S(t\z n , s) = . (158) 

n— >-oo n 

Let j be a classical random variable that is uniformly distributed and has 
states j = 1, 2, • • • , n. Let Ej = ~ ^ .. In the quantum case, we define 

— = (y <:j , z>i, t,j_), 

v = s,~ . (159) 

s = Sj, y = y j , z = z 3 _ 

(Compare this with Eq. (1861) for the classical case). 

After dropping -S(t \ z n , s) and the deltas 5 y , 8 ty , 5 tz , the 4 identities (souped- 
up chain rules) of Claim [8] yield the following 4 inequalities . 

• Eq.flU yields 



R e < -S(s\z n ) (160a) 
n 

= EjS(y ^ : s\g_j, t) — EjS(Zj : s\a_j, t) (160b) 

= S(y.:s\a i ,t,i)-S(z_ i :s\a i ,t,i) (160c) 

= S(y : v\u) — S(z : v\u) . (160d) 
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Eq.flSD yields 



R s = EjS(y.:s\aA,t)-\ — (161a) 

— 3 J n n 

= S(y.:s\a j ,t_,j) + ^-^± (161b) 
-I - - n n 

= S (y : v\u) + ^-^± (161c) 

— n n 

< S{y : v\u) + . (161d) 

— n 



Eq.fHol) yields 



i?t = EjSiy.ia^tf-EjSiy.iy^)--^ (162a) 

= ^(l/^Si.tlj)-^:^!!)-^ 1 (162b) 

v 

= S{y\u\i)-S{y_.:y_ < .\i) ^ (162c) 

< S(y : M|j)-^i (162d) 

— - n 

< S(y : u) - . (162e) 

— n 

Note that j can be cloned because it's classical. Eq.( ll62e]) follows from Claim 
EO 

Eq.gSD yields 



Rt = EjS(Zj : a_p t) — EjS(Zj : z >A ) — (163a) 

= ^Uj : « j , £| J ) - SUj : 1>j | J ) — (163b) 

v 

= S(z : u\ j) - S(z , : z >j \ j) — (163c) 



n 



< S(z:u\j)- -^i (163d) 

- n 

< S(z:u)--^. (163e) 
Eqs. fll62ep and (I163e[) can be combined by writing 
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R t <£-^1 
n 



(164) 



From all we've said so far, it's clear that R G 7t{V gen ). 

QED 

In the above optimality proof, we start with the QB net of Eq. (1127j) . Then we 
do some "chain ruling" reminiscent of peeling n — 1 layers away down to just one. We 
end up with a different QB net with random variables y , z, x, v, u. It's instructive 
to present a chain of QB nets connecting the beginning and ending QB nets of this 
process. 

One starts with the QB net (C implicit) 




[ h.c. ] . (165a) 



Tracing over all the nodes highlighted with a double circle and lumping the traced 
nodes into a reservoir r gives 




The previous QB net equals 
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[ h.c. ] . (165e) 



The previous QB net can be "accommodated" or modeled by the following QB net. 




[ h.c. ] . (165f) 



In the last graph, we leave implicit a (classical) source node j with outgoing arrows 
pointing into all nodes that mention j . 

Note that in Claim HH] (the optimality proof for quantum wiretap coding) all 
the quantum entropies S() were evaluated for the density matrix Eq.( 1165fl) . 

7.3 Achievability 

Claim 20 Achievability: MR, if R E 1Z(V g en), then 3 an encoding and a decoding 
that satisfy lim^oo P err = for the QB net of Eq. \12T\) . 

proof: Suppose p G Vf ac and R G 7£(p). 

We consider all wiretap coding protocols that can be described by the following 
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QB net 



tr r i 
tr r 
tr r 




.0^0 



[ h.c. ] 



r n <— y n , z n , v n , u n 

Lt *~ i 

(166) 

We will use a codebook C = {Cx ,C 2 ,Cu) composed of 3 sub-codebooks. Code- 
book Cx is as an NgNt x n matrix given by Cx = {x n (s, £)}vs,t — £ n (-) where 
z n (s,t)~G SI for all (s,t) G S & x 5*. Similarly, = {w n (s, t)} Vs , 4 = w n (-) where 
v n (s,t) G for all (s,t) and C„ = {u n (*)}vt = «"(•) where w n (t) G for all t. 

We will use the shorthand notations M = (js,t y ,tz) and m = (s,t). Let / be 
the function that maps f(m) = f(s,t) = (s,t,t) for all s,t. 

We assign to the QB net of Eq. fl 1 6 6 [) the following node transition matrices: 



A(s) 



A(t) 



A(u n \t,C) =S(u n ,u n (t)) 



(167) 



(168) 



A(v n \s,u n ,C) = 6{v n ,v n (s,t)) , 
where v n (s,t) = v n (s,u n (t)) ) 

A(x n \v n ,u n ,C) = S(x n ,x n (s,t)) , 
where x n (s ) t) = x n (v n (s 1 t),u n (t)), 



(169) 



(170) 



A(y n ,z n \x n ) = l[A(y j ,z j \x j ) 



(171) 



A(C) =l[A{x n {s,t),v n (s,t),u n (t)) = HAixjis^v^tlujit)) , (172) 



s,t,j 
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where A(v,u) = A 2 \u(v\u)Au(u) and A(x,v,u) = A x\v,u(x\v , u)A(v , u) , and 

5 

A(M\y n ,z n ,C) = l[ J] 0(i* M <r„), (173) 

where the quantities m M , and IV are defined in Appendix [A] Assume that we are 
given the reservoir amplitudes: A(r out \y n , z 11 ) (we choose this one to be an isometry), 
A(r n \y n , z n , v n , u n ) = Ylj A(rj\yj, zj,Vj, Uj), A(rg\s) and A(r± \t). Assume that we are 
also given an isometry A(y,z\x) (called the channel amplitude for this problem). 

The reservoir amplitude A(r out \y n , z n ) is applied by the decoder person and 
is designed to be an isometry. In a moment, we shall explain the reason why we 
need it to be an isometry. The reservoir amplitude A(r n \y n , z n ,v n ,u n ) need not be 
an isometry. It is out of the control of any human agent. As we shall see, as long 
as it factors into n amplitudes, our results (for the measure of success in quantum 
communication) are independent of its value. Our results will also be independent of 
the reservoir amplitudes A(r s\s) and A(r^\t) acting on the inputs. 

Henceforth we will use (T) as shorthand for 

(7) = <%ff| ffi (NK|)|^, (174) 

and A r n for 

A rn = A{r n \y n ,z n ,v n {m ),u n (t )) , (175) 

where m = (so,t ). One finds for the above QB net with the given node transition 
matrices that 



<r>= £ 



.Sr. 



r",r out •- 



A(r out \y n ,z n ) 
A r nA{y n , z n \x n { 



h.c. 
m — > m' 

(176) 



where S c = J2 C A ( C )- 

We immediately perform the sum over r out . Since A(r out \y n , z n ) is an isometry, 
upon summing over r out , the random variables y n and z n become classical. Making y n 
and z n classical random variables is the raison d'etre for the isometry A(r out \y n , z n ). 
Thus, we get 



(T>= \ £ cA rn A(y 



0(R^ < IV) 



h.c. 



(177) 
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Let 



n n 



2rri (& M (m M ) - z'e) 



and 



E *. 

We will also use the following shorthand notation 

x = x(s, t) , u = u(s", i) , m = tt(i) , 



£ = (^y > ^»(0> u ( , )> u (0) > 
A r = A(r|2/,2,v(mo),u(to)) , 

A r = A(r\y,z,v,u) . 
Expressing the 9 functions in Eq. (ll77j) as integrals, we get 



and 



(V= E [A^ E ^^E a! -(.,,^(.) eE ^ I<0I,lZ<0 



r n ,y n ,z n 



h.c. 

m — >■ m' 
M ->■ M' 



(178) 

(179) 

(180) 
(181) 
(182) 

(183) 



(184) 



where 



Z{£) = A r A(y,z\x(mo))Y[{A( x {s,t),v(s,t),u(t))}Yl Yl l 7 ^ " f ( 185a ) 

s,t m=1 m^fhft ' 

A r A(y, z|x(mo)) n s ,t { ^(a;(s,t)|t;(s,t),M(t)) } 

r5 f j je^e) ^ , (185b) 



n s , t { am*, *),«(*)) }nUrw^ {7f (r) 

where the quantities 7 M are defined in Appendix lAl 

Next we express the sum over x n (-),v n (-),u n (-) in Eq. ( 1184ft as a p-type integral 
and do the p-type integration by the steepest descent method. We get for the leading 
order term: 



(T)= E I § k e-^ K ^e^ 



. nPy l (r,y,z) In Z(r,y,z) 



r n ,y",z n 



h.c. 

M — >• M' 



(186) 
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where 



Z(r,y,z)= Yl ( 187 ) 

If we define 

A(y,z\v(-),u(-),mo) = A (v, ^W) II M^s,t)\v(s,t), u(t)) , (188) 

x(-) s,t 

then Z(r, y, z) can be expressed as 

Z(r,y,z) = £ v{ . )M .)A r A(y,z\v(-),u(-),m ) [[ Slv " f- ( 189 ) 
Define 

Z mid (r, y, z) = ^ >2 A r A(y, z\v, u) J[ { $^ 1 , (190) 

where 

A(y, u) = z|x)v4(x|f , m) , (191) 

X 

and where the quantities $ M are defined in Appendix HI 
Define the integration operators 

^ = n ( f 00 ^ f 00 ^ e ~"^ i ( i92 ) 



and 



27T 

— oo J — oo " " 



n^>°)- ( i93 ) 

Note that 1 equals 

= l wr e i ^' , ''^^W . (194b) 

Multiplying (T) by 1 certainly doesn't change it. Thus the right hand sides of 
Eqs. (11861) and ( j!94bl) can be multiplied to get 
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r n ,y n ,z n 



h.c. 

-,. )1 l: fK) fi E r!S , z ''-P[i('-A2)ia2(w) m ->m[, 

M-> M' 
(195) 

Next we will assume that, for all m^, when doing the contour integration over 
k^{m^) in Eq. (ll95j) with Z(r,y,z) given by Eq. (11891) . the e nlnZ ( r ^> 2 ) ca n be evaluated 
at the value k^m^) = ie — » of the pole. Furthermore, we will assume that only the 
terms with M = mo gwe a non-vanishing contribution to the integral. Symbolically, 
this means we will assume 



§f^ l o) e J2 r!VtZ nP l] {r,y,z)lnZ mid (r,y,z) 1 giE^eEm^ M"V) 



Applying Eq. (fl96b]) to Eq.dEEJ gives 



(196a) 
(196b) 



(T) = 5g mo) 5g™° } E [ i h>0 ^ e -*E M if^ e Er,v.*" p t] (»-.».*) ^^wfr*.*) ] [ h.c. ] . 

(197) 

Next we express the sum over r n , y n , z n in Eq. fll97p as a p-type integral and do 
the p-type integration by the steepest descent method. We get for the leading order 
term: 



where 



\'l°M °mi L h>0,Ki-h'>0,K' e M e 



fin 



M M 



:i98i 



fin 



[ Z mid (r,y,z) ] 



r,y,z 



h.c. 



J2 £ v,u£v>,u> \ A r A{y, z\v, u) I +i E M K„ In $ M 

--E KMK 



r,y,z 



where we approximated 



Y[®1" ~ l + -^^ln^ . 



h.c. 

w — > u ' 

U — 7" «' 



(199a) 



(1,99b) 



(200) 



44 



Because p E Vf ac , we may set in the right hand side of Eq. (1199bl) 

A(y, z\v, u) = A(y\v, u)A(z\v, u) , (201) 

where A(y\v,u) and A(z\v,u) are both isometries. It is important to notice that 
^ In $ M is a sum of terms each of which only depends either on y or z but not 
both. Thus in Eq. ( 1199b]) . either the y sum or the z sum (or both) kills all terms except 



those with u = u' and v = v f . Hence 



Z fin = \A-A(y,z\v,u)A(v,u)\ 2 i 1 + ^ - i^) ln$ J (202a) 

r,y,z,v,u \ /i / 

= l + -J2(K»-K) E y,*^ ln ®^ ( 202b ) 



n 

A 1 



n\nZ fin « i^2(K^ - jQ^^ln . (203) 
Combining Eqs.flMD and (M) yields 



(T) = ^^^Ml^o^^^^E^^^in^l 2 (204a) 

= 4 mo) 4r° } n^<^) (204b) 



S tto) 5 fW) e (ii G ft(p)) , (204c) 



where the quantities are defined in Appendix lAl 
QED 



7.4 Capacity 

All statements^ made in Section 16.31 for the channel capacity for classical wiretap 
coding are also valid for a quantum wiretap coding, as long as (1) classical informa- 
tions Hp are replaced by quantum informations S p throughout, and (2) the symbols 
'Pgen, 'Pfac and 1Z(V) are defined as they were defined for quantum instead of classical 
wiretap coding. 

4 Except for Claim [TBI In the quantum case, Claim[T6jis true with H() — > S() if one adds to the 
claim the additional assumption that e is a classical random variable. For if e is a classical random 
variable at the middle of a Markov chain, then we can assert that S(a : b\e) = 0. 
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A Appendix: Table of Quantities Used In 

Both Classical and Quantum Wiretap Coding 











7m 






1 


(S, ty ft zj 


Re 


1^2?/ — T2z 


72 z 




#(y : £ 


u) — H(z : v \ u) 


2 


(Mi/) 


Rs + -Rt 


^2y + Tl y 


72ylly 




H(y : v 


u ) + if( y : u) 


3 


(M«) 


-Rs + -R* 


^2y + Tiji 


l2yl\z 




H(y : v 


u) + F(z : w) 


4 


ty 








$1 W 


H(y : u) 


5 






r i2 


7i* 


$1, 


H{z : u) 



The last column of the table of Eq. (12051) is for the classical case, 
are evaluated at some P G TZ(V gen ). In the quantum case, should be 
by Sfj,, and all HQ's should be replaced by 5()'s. The 5()'s are evaluated 
p e K(V gen ). 

In the classical case, one defines 



(205) 
The tf's 
replaced 
at some 



1 P(yV^fty)) 



(y z) 



P{y.u{t y )) 



(y z) , 



P(y:u(t y J) 
$i v = P{y : u(t)) , (y++z) 

^ _ 1 P(y n : v n (sSy)\u n (ty)) 
2y n n P(y" :v n (s,ty)\u n (ty)) ' 

P(y : u(s,t y )|«(t y )) 



(y z) 



lly 



P(y : u(s,ty)K*y)) 



(y z) 



and 



* 2j , = P{y ■ v{s,t)\u{t)) , (y**z). 
Note that T M and 7 M are related by 

r ^=EE E E ^](y^,«(-),«(0)M7^)- 



(206) 

(207) 
(208) 

(209) 

(210) 

(211) 
(212) 



y£S y zeSz 



Note that $ M is evaluated at t y = t 5 = t. 

In the quantum case, Eqs. ( 1206j) to ( 12 12ft must be changed as follows. 
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In the quantum case, p y ,z,v,u is given. From it, one can define P y ,z,v,u = 
\Ay,z,v,u\ 2 - Suppose x,y,e are three distinct random variables from the set {y , z, v_ 
Define the function : R >0 — > R by 



r = r 



In Eqs.([206]) to fl2T2l . replace any ±\nP{x n : y n |e") b}@ 



P(w) W(<\B,3/,e(/> £ ,i,,e)) 



-UuP^x" : ^|e") = ^ P^n^x, y, e) < 



+ p^yln0(A e (pe)) 

p^yln0(A x>e (p i£i e)) 



^yln0(Aj /ie (py > e)) 



and any lnP(x : y\e) by 



(213) 



> , (214) 



lnP br (x : y|e) = expression inside curly brackets in Eq. (l214p . 
Also replace any - In P(x n : y n ) by 



(215) 



\nP br (x n : 



n 



[x n ,y n ] 



1 \n<p(X x (p x )) 



P(x) 

In <f)(\ y ( P y)) 



and any In P(x : y) by 



(216) 



lnP 6r (x : y) = expression inside curly brackets in Eq. (12 16ft . (217) 

Note that the bridge functions P br depend on both px,y,e and Px,j/,e- Note 
also that the bridge functions equal the classical functions they are replacing when 
Px, y ,e is diagonal (the classical case). 
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